Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dependabot is joining GitHub

dependabot.com

Post reply on HN
Print view View original

11–20 of 47 posts

Re: Dependabot is joining GitHub

#11

Post by Kalium »

the_duke wrote: post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

If the increase in homogenization comes from everyone keeping their packages up to date and secure, I'm going to see that as a net win for the community.

Re: Dependabot is joining GitHub

#12

Post by onion2k »

hanniabu wrote: post #8
the_duke wrote: post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

> But: all the built-in tools will have an inherent advantage over third party solutions. This inevitably leads to increased lock-in and homogenization. There's no lock-in, you can continue whatever integrations or pipeline you have now. This just gives an easier option. Them offering Github Pages isn't lock-in to their hosting, but it offers convenience in various scenerios.

This just gives an easier option.

These features are a disincentive for users to look for alternatives, which in turn is a disincentive for people to start businesses to provide alternatives, which altogether has a cooling effect on the tooling ecosystem.

That's not to say GitHub shouldn't provide these options. They're useful additions to a great platform. My remark is simply about the economics of a supplier with substantial market share adding a new feature. It has a wider impact that being 'just another option'.

Re: Dependabot is joining GitHub

#13

Post by lasagnaphil »

hanniabu wrote: post #8
the_duke wrote: post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

> But: all the built-in tools will have an inherent advantage over third party solutions. This inevitably leads to increased lock-in and homogenization. There's no lock-in, you can continue whatever integrations or pipeline you have now. This just gives an easier option. Them offering Github Pages isn't lock-in to their hosting, but it offers convenience in various scenerios.

If you view Github as just a Git (and occasionally static site) hosting service, then there's not lock-in whatsover; you can always move to somewhere like Gitlab or host your own. But the point is: Github isn't just a Git website anymore; it creates a community around it. Right now the reason why people aren't easily moving out of Github is because by moving to somewhere else, they have to risk getting less views, less recognition, and less pull requests for their libraries. Also, if you were a Sponsor in Github and earning $30000 a month and then had disagreements with Github's policies and want to get out, you now have to risk shaving off all your sponsors to switch to a different service like Liberapay. Maybe some of your passionate existing patrons will go towards the extra effort to switch alongside you, but the reality is: most won't.

There were lots of promises and hopes for the patron economy (or I would extend this to call it a "distributed economy"), where people can directly give money as reward for their work while avoiding the traditional hierarchical structure of corporations. However, because of the nature of the current society we live in, the ideal version of this economy would never come to fruition. Think of examples such as Patreon, Youtube, and recently Github; they're an enabler for diverse communities, rich subcultures, and innovative ideas, but the users still have to live under the guise of huge capitalistic forces. It seems that the distributed economy still has to live under the current technocratic system (where huge tech corporations have much higher leverage than small companies or non-profit organizations). To see this relationship between users and corporations as either symbiotic or exploitative is up to your choice, but I think the status-quo will stay for quite some time.

Re: Dependabot is joining GitHub

#14

Post by Kalium »

lasagnaphil wrote: post #13
hanniabu wrote: post #8

Earlier quoted context omitted.

> But: all the built-in tools will have an inherent advantage over third party solutions. This inevitably leads to increased lock-in and homogenization. There's no lock-in, you can continue whatever integrations or pipeline you have now. This just gives an easier option. Them offering Github Pages isn't lock-in to their hosting, but it offers convenience in various scenerios.

If you view Github as just a Git (and occasionally static site) hosting service, then there's not lock-in whatsover; you can always move to somewhere like Gitlab or host your own. But the point is: Github isn't just a Git website anymore; it creates a community around it. Right now the reason why people aren't easily moving out of Github is because by moving to somewhere else, they have to risk getting less views, le…

If you were a Sponsor in Liberapay and earning $30000 a month and then had disagreements with Liberapay's policies and want to get out, you now have to risk shaving off all your sponsors to switch to a different service like GitHub. Maybe some of your passionate existing patrons will go towards the extra effort to switch alongside you, but the reality is: most won't.

This isn't an argument against GitHub or LiberaPay. This is an argument against being locked in to any financial intermediary.

Re: Dependabot is joining GitHub

#17

Post by rvanmil »

Did GitHub just activate this without confirmation or notification? I'm suddenly receiving PR's on my repo's from dependabot without ever activating this tool.

Edit: looks like they defaulted to enable "Automated security fixes" on the Security > Alerts tab.

Re: Dependabot is joining GitHub

#18

Post by [deleted] »

prepend wrote: post #10
the_duke wrote: post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

I would agree if this came with changes that would block out newcomers. But third parties can still build just as they always have been. As a user, I like that new features are now free instead of paid plugins. I see this more as trying to get to parity with GitLab with a function of more advanced maturity with cloud computing that’s making it cheaper for Github to run more scheduled task type stuff (scanning and ale…

[deleted]

Re: Dependabot is joining GitHub

#19

Post by hcm »

jeffshek wrote: post #7

Huge congrats to Dependabot team! If you're starting a new project in Python (+ others), having Dependabot + CircleCI (or something equivalent) + Strong test coverage will save you hundreds of hours (eventually). Best trick is to make sure your test coverage is strong early (I know this is easier said than done ...), then you can just merge updated requirements without ever worrying. GitHub has a type of service that…

Thanks!

Re: Dependabot is joining GitHub

#20

Post by ralphstodomingo »

the_duke wrote: post #6

Edit: copy/pasting my more extensive comment from the Sponsors thread. All the recent additions to Github are superficially very nice and convenient features (Actions, package registry, Sponsors, Dependabot). But they represent a very significant change in mindset. Github is turning from a neutral code hosting platform with a myriad of equally empowered third party integrations into the direction of a "all in one" de…

For some reason centralization is such a loaded term these days, and I wonder why.

There are things that centralization deals with that decentralized, open solutions seem to neglect. For example, pushing GitHub to become an all-in-one platform reduces fatigue of having to learn multiple, independent third-party apps/platforms. Not everyone wants nor knows how to write glue/infra code, time is essential and there are other problems to solve. I may be ignorant, but is this related to why AWS took off the way it did?

Add to this the potential combinations of integrations that you need to learn. An internet resource may teach you how to do x+y+z, but if you happen to want to use x+r+z then you're out of luck, will probably take you a lot of time to sort that out.

For some amount of time, I don't remember anything similar like GitHub back then when it launched. Correct me if I'm wrong. I think we can't discount the insight Github has opened us up to, leading to other providers like Gitlab and such. I'm not afraid of homogenization and lock-in, I'm afraid of people getting tired of too many things to learn to be productive these days. There's got to be a point where you stop decentralizing, because where does it end?

> all the built-in tools will have an inherent advantage over third party solutions

If the built-in tools are superior and more effective than third-party solutions, is that a bad thing? If not, then we should do our part and advocate/support the better third-party ones than bring ourselves down against e.g. Github just because things have been getting better and we can't let go of our prejudices.

I'm not a GitHub fanboy nor do I abhor decentralization. I just think it always warrants a case-to-case examination, deep thought. When you start making comments such as "_superficially_ very nice and convenient" when e.g. Sponsors is objectively good for the OSS maintainers and bad for absolutely no one, then you've got to be skeptical of how skeptical you are about things.

Post reply on HN